Eric Dumazet be2b5a78a0 netfilter: conntrack: annotate data-races around ct->timeout ... commit 802a7dc5cf upstream. (struct nf_conn)->timeout can be read/written locklessly, add READ_ONCE()/WRITE_ONCE() to prevent load/store tearing. BUG: KCSAN: data-race in __nf_conntrack_alloc / __nf_conntrack_find_get write to 0xffff888132e78c08 of 4 bytes by task 6029 on cpu 0: __nf_conntrack_alloc+0x158/0x280 net/netfilter/nf_conntrack_core.c:1563 init_conntrack+0x1da/0xb30 net/netfilter/nf_conntrack_core.c:1635 resolve_normal_ct+0x502/0x610 net/netfilter/nf_conntrack_core.c:1746 nf_conntrack_in+0x1c5/0x88f net/netfilter/nf_conntrack_core.c:1901 ipv6_conntrack_local+0x19/0x20 net/netfilter/nf_conntrack_proto.c:414 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0x72/0x170 net/netfilter/core.c:619 nf_hook include/linux/netfilter.h:262 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] ip6_xmit+0xa3a/0xa60 net/ipv6/ip6_output.c:324 inet6_csk_xmit+0x1a2/0x1e0 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x132a/0x1840 net/ipv4/tcp_output.c:1402 tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline] tcp_write_xmit+0x1450/0x4460 net/ipv4/tcp_output.c:2680 __tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2864 tcp_push_pending_frames include/net/tcp.h:1897 [inline] tcp_data_snd_check+0x62/0x2e0 net/ipv4/tcp_input.c:5452 tcp_rcv_established+0x880/0x10e0 net/ipv4/tcp_input.c:5947 tcp_v6_do_rcv+0x36e/0xa50 net/ipv6/tcp_ipv6.c:1521 sk_backlog_rcv include/net/sock.h:1030 [inline] __release_sock+0xf2/0x270 net/core/sock.c:2768 release_sock+0x40/0x110 net/core/sock.c:3300 sk_stream_wait_memory+0x435/0x700 net/core/stream.c:145 tcp_sendmsg_locked+0xb85/0x25a0 net/ipv4/tcp.c:1402 tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1440 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:644 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] __sys_sendto+0x21e/0x2c0 net/socket.c:2036 __do_sys_sendto net/socket.c:2048 [inline] __se_sys_sendto net/socket.c:2044 [inline] __x64_sys_sendto+0x74/0x90 net/socket.c:2044 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff888132e78c08 of 4 bytes by task 17446 on cpu 1: nf_ct_is_expired include/net/netfilter/nf_conntrack.h:286 [inline] ____nf_conntrack_find net/netfilter/nf_conntrack_core.c:776 [inline] __nf_conntrack_find_get+0x1c7/0xac0 net/netfilter/nf_conntrack_core.c:807 resolve_normal_ct+0x273/0x610 net/netfilter/nf_conntrack_core.c:1734 nf_conntrack_in+0x1c5/0x88f net/netfilter/nf_conntrack_core.c:1901 ipv6_conntrack_local+0x19/0x20 net/netfilter/nf_conntrack_proto.c:414 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0x72/0x170 net/netfilter/core.c:619 nf_hook include/linux/netfilter.h:262 [inline] NF_HOOK include/linux/netfilter.h:305 [inline] ip6_xmit+0xa3a/0xa60 net/ipv6/ip6_output.c:324 inet6_csk_xmit+0x1a2/0x1e0 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x132a/0x1840 net/ipv4/tcp_output.c:1402 __tcp_send_ack+0x1fd/0x300 net/ipv4/tcp_output.c:3956 tcp_send_ack+0x23/0x30 net/ipv4/tcp_output.c:3962 __tcp_ack_snd_check+0x2d8/0x510 net/ipv4/tcp_input.c:5478 tcp_ack_snd_check net/ipv4/tcp_input.c:5523 [inline] tcp_rcv_established+0x8c2/0x10e0 net/ipv4/tcp_input.c:5948 tcp_v6_do_rcv+0x36e/0xa50 net/ipv6/tcp_ipv6.c:1521 sk_backlog_rcv include/net/sock.h:1030 [inline] __release_sock+0xf2/0x270 net/core/sock.c:2768 release_sock+0x40/0x110 net/core/sock.c:3300 tcp_sendpage+0x94/0xb0 net/ipv4/tcp.c:1114 inet_sendpage+0x7f/0xc0 net/ipv4/af_inet.c:833 rds_tcp_xmit+0x376/0x5f0 net/rds/tcp_send.c:118 rds_send_xmit+0xbed/0x1500 net/rds/send.c:367 rds_send_worker+0x43/0x200 net/rds/threads.c:200 process_one_work+0x3fc/0x980 kernel/workqueue.c:2298 worker_thread+0x616/0xa70 kernel/workqueue.c:2445 kthread+0x2c7/0x2e0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 value changed: 0x00027cc2 -> 0x00000000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 17446 Comm: kworker/u4:5 Tainted: G W 5.16.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: krdsd rds_send_worker Note: I chose an arbitrary commit for the Fixes: tag, because I do not think we need to backport this fix to very old kernels. Fixes: e37542ba11 ("netfilter: conntrack: avoid possible false sharing") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-14 10:57:10 +01:00
..
9p
bluetooth	Bluetooth: Store advertising handle so it can be re-enabled	2021-08-16 17:53:48 +02:00
caif	net: remove the caif_hsi driver	2021-07-01 13:19:48 -07:00
iucv
netfilter	netfilter: conntrack: annotate data-races around ct->timeout	2021-12-14 10:57:10 +01:00
netns	ipv4: convert fib_num_tclassid_users to atomic_t	2021-12-08 09:04:49 +01:00
nfc	NFC: add NCI_UNREG flag to eliminate the race	2021-11-25 09:48:40 +01:00
phonet
sctp	sctp: subtract sctphdr len in sctp_transport_pl_hlen	2021-11-18 19:16:43 +01:00
tc_act	net/sched: act_vlan: Fix modify to allow 0	2021-06-01 16:54:42 -07:00
6lowpan.h
act_api.h	net_sched: refactor TC action init API	2021-08-02 10:24:38 +01:00
addrconf.h	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.	2021-04-27 14:02:06 -07:00
af_ieee802154.h
af_rxrpc.h	afs: Don't truncate iter during data fetch	2021-04-23 10:17:26 +01:00
af_unix.h	af_unix: Add unix_stream_proto for sockmap	2021-08-16 18:43:39 -07:00
af_vsock.h	af_vsock: rest of SEQPACKET support	2021-06-11 13:32:46 -07:00
ah.h
arp.h
atmclip.h
ax25.h
ax88796.h	ax88796: export ax_NS8390_init() hook	2021-08-03 13:05:25 +01:00
bareudp.h
bond_3ad.h	bonding: add new option lacp_active	2021-08-03 11:50:22 +01:00
bond_alb.h	bonding: make tx_rebalance_counter an atomic	2021-12-14 10:57:09 +01:00
bond_options.h	bonding: add new option lacp_active	2021-08-03 11:50:22 +01:00
bonding.h	bonding: remove extraneous definitions from bonding.h	2021-08-11 14:57:31 -07:00
bpf_sk_storage.h	bpf: struct sock is declared twice in bpf_sk_storage header	2021-03-26 17:43:55 +01:00
busy_poll.h	net: annotate data race around sk_ll_usec	2021-07-01 11:23:50 -07:00
calipso.h
cfg80211-wext.h
cfg80211.h	cfg80211: fix management registrations locking	2021-10-25 15:20:22 +02:00
cfg802154.h
checksum.h	csum_and_copy_to_iter(): massage into form closer to csum_and_copy_from_iter()	2021-06-10 11:45:14 -04:00
cipso_ipv4.h
cls_cgroup.h
codel_impl.h
codel_qdisc.h
codel.h
compat.h	net/ipv4/ipv6: Replace one-element arraya with flexible-array members	2021-08-05 11:46:42 +01:00
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: Use xarray to store devlink instances	2021-08-14 13:59:10 +01:00
dn_dev.h
dn_fib.h	net: convert fib_treeref from int to refcount_t	2021-07-30 15:33:24 +02:00
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsa.h	net: dsa: tear down devlink port regions when tearing down the devlink port on error	2021-09-19 13:05:44 +01:00
dsfield.h
dst_cache.h	wireguard: device: reset peer src endpoint when netns exits	2021-12-08 09:04:46 +01:00
dst_metadata.h	net: validate lwtstate->data before returning from skb_tunnel_info()	2021-07-09 13:55:53 -07:00
dst_ops.h
dst.h	sk_buff: track dst status in slow_gro	2021-07-29 12:18:11 +01:00
erspan.h
esp.h
espintcp.h
ethoc.h
failover.h
fib_notifier.h
fib_rules.h	ipv6: fix memory leak in fib6_rule_suppress	2021-12-08 09:04:43 +01:00
firewire.h
flow_dissector.h	flow_dissector: constify raw input data argument	2021-03-14 14:46:32 -07:00
flow_offload.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-08-19 18:09:18 -07:00
flow.h	flow: fix object-size-mismatch warning in flowi{4,6}_to_flowi_common()	2021-09-02 11:44:19 +01:00
fou.h
fq_impl.h
fq.h
garp.h
gen_stats.h
genetlink.h	mptcp: avoid lock_fast usage in accept path	2021-02-12 16:31:46 -08:00
geneve.h
gre.h
gro_cells.h
gro.h	gro: add combined call_gro_receive() + INDIRECT_CALL_INET() helper	2021-03-18 19:51:12 -07:00
gtp.h
gue.h
hwbm.h
icmp.h	ipv6: ICMPV6: add response to ICMPV6 RFC 8335 PROBE messages	2021-06-28 14:29:45 -07:00
ieee80211_radiotap.h	mac80211: Use flex-array for radiotap header bitmap	2021-08-13 09:58:25 +02:00
ieee802154_netdev.h
if_inet6.h	ipv6: add IFLA_INET6_RA_MTU to expose mtu value	2021-08-27 17:29:18 -07:00
ife.h
ila.h
inet_common.h
inet_connection_sock.h	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 19:16:33 +01:00
inet_ecn.h
inet_frag.h
inet_hashtables.h	tcp: seq_file: Replace listening_hash with lhash2	2021-07-23 16:44:57 -07:00
inet_sock.h
inet_timewait_sock.h
inet6_connection_sock.h
inet6_hashtables.h
inetpeer.h
ioam6.h	ipv6: ioam: Support for IOAM injection with lwtunnels	2021-07-21 08:14:33 -07:00
ip_fib.h	ipv4: convert fib_num_tclassid_users to atomic_t	2021-12-08 09:04:49 +01:00
ip_tunnels.h	ip_tunnel: use ndo_siocdevprivate	2021-07-27 20:11:44 +01:00
ip_vs.h
ip.h	net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward	2021-07-21 08:22:03 -07:00
ip6_checksum.h
ip6_fib.h	net: ipv6: add fib6_nh_release_dsts stub	2021-12-01 09:04:49 +01:00
ip6_route.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-08-05 15:08:47 -07:00
ip6_tunnel.h
ipcomp.h
ipconfig.h
ipv6_frag.h
ipv6_stubs.h	net: ipv6: add fib6_nh_release_dsts stub	2021-12-01 09:04:49 +01:00
ipv6.h	ipv6: Add a sysctl to control multipath hash fields	2021-05-18 13:27:32 -07:00
iw_handler.h
kcm.h
l3mdev.h
lag.h
lapb.h	net: lapb: Make "lapb_t1timer_running" able to detect an already running timer	2021-03-23 14:14:50 -07:00
lib80211.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h	net: llc: fix skb_over_panic	2021-07-27 13:05:56 +01:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h	llc: fix out-of-bound array index in llc_sk_dev_hash()	2021-11-18 19:17:10 +01:00
lwtunnel.h	netfilter: add netfilter hooks to SRv6 data plane	2021-08-30 01:51:36 +02:00
mac80211.h	mac80211: Fix Ptk0 rekey documentation	2021-09-27 12:02:54 +02:00
mac802154.h
macsec.h	net: macsec: fix the length used to copy the key for offloading	2021-06-24 12:41:12 -07:00
mctp.h	mctp: unify sockaddr_mctp types	2021-10-18 13:47:09 +01:00
mctpdevice.h	mctp: Remove the repeated declaration	2021-08-25 11:23:14 +01:00
mip6.h
mld.h	mld: add new workqueues for process mld events	2021-03-26 15:14:56 -07:00
mpls_iptunnel.h
mpls.h
mptcp.h	mptcp: fix corrupt receiver key in MPC + data + checksum	2021-10-28 08:19:06 -07:00
mrp.h
ncsi.h
ndisc.h
neighbour.h	net, neigh: Enable state migration between NUD_PERMANENT and NTF_USE	2021-11-18 19:17:16 +01:00
net_failover.h
net_namespace.h	netfilter: remove xt pernet data	2021-08-01 12:00:51 +02:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h	net: netlink: add the case when nlh is NULL	2021-07-27 11:43:50 +01:00
netprio_cgroup.h
netrom.h
nexthop.h	net: ipv4: Fix rtnexthop len when RTA_FLOW is present	2021-09-24 14:07:10 +01:00
nl802154.h	net: ieee802154: handle iftypes as u32	2021-12-01 09:04:46 +01:00
nsh.h
p8022.h
page_pool.h	page_pool: add frag page recycling support in page pool	2021-08-09 15:49:00 -07:00
pie.h
ping.h
pkt_cls.h	sch_htb: Fix inconsistency when leaf qdisc creation fails	2021-08-30 16:33:59 -07:00
pkt_sched.h	net: prevent user from passing illegal stab size	2021-09-26 11:09:07 +01:00
pptp.h
protocol.h	net: Remove the member netns_ok	2021-05-17 15:29:35 -07:00
psample.h	psample: Add a fwd declaration for skbuff	2021-08-09 15:34:21 -07:00
psnap.h
raw.h
rawv6.h
red.h	sch_red: fix off-by-one checks in red_check_params()	2021-03-25 17:40:43 -07:00
regulatory.h
request_sock.h
rose.h
route.h
rpl.h
rsi_91x.h
rtnetlink.h	net: add extack arg for link ops	2021-08-04 10:01:26 +01:00
rtnh.h
sch_generic.h	net: sched: update default qdisc visibility after Tx queue cnt changes	2021-11-18 19:16:10 +01:00
scm.h
secure_seq.h
seg6_hmac.h
seg6_local.h
seg6.h
selftests.h	net: selftest: fix build issue if INET is disabled	2021-04-28 14:06:45 -07:00
slhc_vj.h
smc.h
snmp.h
sock_reuseport.h	tcp: Add reuseport_migrate_sock() to select a new listener.	2021-06-15 18:01:05 +02:00
sock.h	tcp: fix page frag corruption on page fault	2021-12-08 09:04:46 +01:00
Space.h	wan: remove sbni/granch driver	2021-08-03 13:05:26 +01:00
stp.h
strparser.h	bpf, sockmap: sk_skb data_end access incorrect when src_reg = dst_reg	2021-11-18 19:17:11 +01:00
switchdev.h	net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge	2021-08-04 12:35:07 +01:00
tcp_states.h
tcp.h	tcp: switch orphan_count to bare per-cpu counters	2021-11-18 19:16:33 +01:00
timewait_sock.h
tipc.h
tls_toe.h
tls.h	net/tls: Fix flipped sign in tls_err_abort() calls	2021-10-28 14:41:20 +01:00
transp_v6.h
tso.h
tun_proto.h
udp_tunnel.h
udp.h	net: multicast: calculate csum of looped-back and forwarded packets	2021-10-26 13:09:22 +01:00
udplite.h
vsock_addr.h
vxlan.h
wext.h
x25.h
x25device.h
xdp_priv.h
xdp_sock_drv.h
xdp_sock.h	xdp: Add proper __rcu annotations to redirect map entries	2021-06-24 19:41:15 +02:00
xdp.h	bpf: Add function for XDP meta data length check	2021-07-07 19:51:12 -07:00
xfrm.h	xfrm: Add possibility to set the default to block if we have no policy	2021-07-21 09:49:19 +02:00
xsk_buff_pool.h	xsk: Fix missing validation for skb and unaligned mode	2021-06-18 16:57:19 +02:00